TWI620089B - Secure computer - Google Patents

Abstract

The present invention relates to systems and architectures for protecting other non-secure computer subsystems. According to one aspect, the present invention provides an independent hardware platform for executing software in a secure manner. According to another aspect, the present invention provides a means of controlling and protecting all discs, networks, and other I/O transactions. According to still further aspects, the present invention provides a means of monitoring and preventing unauthorized users and malicious software activities. Additional aspects include providing a security platform for device and user authentication and encryption key management; providing means to perform background backup snapshots; and providing means to enable full management of computer operations.

Description

Security computer

The present invention relates to systems and architectures for protecting computer systems having non-secure subsystems.

The state of the art of computer system security is significantly advanced in the application Serial No. 13/396,582, the disclosure of which is incorporated herein in its entirety by reference. However, there are still some challenges and opportunities for improvement.

Conventional computing devices typically include: one-to-many, well-known types of subsystems, such as storage devices, networking, audio/video, I/O interfaces, and the like. However, such subsystems are often inherently insecure and vulnerable to many different types of threats.

For example, as shown in FIG. 1A, a conventional non-secure computer 150 (eg, a desktop or notebook computer) includes a host system 102, which typically includes a CPU that executes an operating system, application software, and device drivers. . The computer 150 further includes means 106 associated with various computer subsystems, such as an internal driver 106-1 (e.g., HDD or SSD), an audio/video input and output device 106-2 (e.g., display, speaker, etc.), I/O. And device 106-3 (such as USB, Firewire, etc.) and network interface 106-4 (such as WiFi, Ethernet, etc.).

The lack of security of the subsystems associated with such devices has led to many weaknesses. More specifically, with respect to internal drive 106-1, the data stored on internal driver 106-1 is typically unencrypted. This means that if the material is discarded or the material is sneaked (for example, by someone stealing the computer 150 or by the virus software on the host 102), the content inside the data can be retrieved, including any sensitive or private content. Use or confidential information. In addition, many users do not regularly back up the data of their users, making the data on the drive 106-1 vulnerable to drive or system failure.

Even if data is encrypted and/or backed up, the security level of the data depends on the particular operating system and application. In addition, if the encryption key is also stored on the computer 150, their encryption keys may be secretly accessed and used. With regard to the audio/video input and output device 106-2, the displayed data or the audio played may include sensitive information that is susceptible to eavesdropping, particularly when the computer 150 is operated in a public place. However, when an unauthorized copy of the displayed information is found, it is sometimes difficult to prove the source or environment of the unauthorized copy.

With regard to I/O ports and devices 106-3, standard I/O protocols such as USB do not provide any level of security for transferring data from peripheral devices to the host system. USB data is sent in clear text. Therefore, the data can be captured and analyzed by any USB protocol analysis program or software application. In addition, any USB peripheral device can be connected to the host computer because the USB specification does not provide any means to filter unwanted or potentially harmful devices. This poses a huge risk to the business and, more specifically, is responsible for protecting their IT systems and devices. The entire IT administrator poses a huge risk. Still further, the USB device may contain executable programs that can run on the computer 150 (and potentially potentially damage the computer 150).

With respect to the network interface 106-4, the information sent over the network may include sensitive information that is easily intercepted. In addition, network data received by computer 150 may include harmful applications such as viruses and malware. Some organizations use some of these security protocols, such as VPNs, to provide some level of security through their organization's internal network. However, not all computers in the organization use VPN security protocols for their network connections. And even when their network connections use VPN security protocols, their agreements are not always automatically turned on before the boot/network connection, providing a window of opportunity for the resident malware to send/receive information. In addition, VPN connections in software are quite slow, and their connections do not support high-bandwidth connections, such as high-bandwidth connections of hundreds of megabits per second (eg, 100Mbs or 1Gbs and higher Ethernet). In principle, all network communications (whether internal or external) using the organization's computer should be protected.

It should be apparent from the above that many applications will benefit from being able to add security seamlessly and without interference via the above or other subsystems, and/or benefit from centrally managing such additional security features via the organization's computer device.

The present invention relates to systems and architectures for protecting non-secure computer subsystems and IO interfaces that address the above deficiencies and the like. According to one aspect, the present invention provides an independent hardware platform for executing software in a secure manner. According to another aspect, the present invention provides a means of controlling and protecting all discs, networks, and other I/O transactions. According to a further aspect, the present invention provides supervision Control and prevent unauthorized users and malicious software activities. Additional aspects include providing a security platform for device and user authentication and encryption key management; providing means to perform background backup snapshots; and providing means to enable full management of computer operations.

According to these and other aspects, a security computer according to an embodiment of the present invention includes: a plurality of subsystems for receiving, storing, extracting, and outputting data from a storage device; a host system, the host system An operating system and an application for receiving, storing, extracting, and outputting data; and a security subsystem that controls access by the host system to the plurality of subsystems.

102‧‧‧Host

104‧‧‧Security System

106‧‧‧ device

106-1‧‧‧VCD

106-2‧‧‧Audio/Video Device

106-3‧‧‧埠

106-4‧‧‧Network

120‧‧‧Security computer

150‧‧‧ computer

170‧‧‧Security connection

172‧‧‧Connect

206‧‧‧Remote Management System

208‧‧‧Communication channel

220‧‧‧ Appliances

220-1‧‧‧Point of sale device

220-2‧‧‧Note Computer

220-3‧‧‧PC

302‧‧‧Host system

304‧‧‧Security Subsystem

308‧‧‧Communication channel

320‧‧‧Security computer

352‧‧‧Subsystem/USB Subsystem

354‧‧‧Subsystem/Network Subsystem

356‧‧‧Subsystem/storage subsystem

358‧‧‧Subsystem/Audio Subsystem

360‧‧‧Subsystem/Video/Graphics Subsystem

362‧‧‧Security Processor

These and other aspects and features of the present invention will become apparent to those skilled in the <RTIgt; 1A is a block diagram illustrating an exemplary non-secure computer system in accordance with the prior art; FIG. 1B is a block diagram illustrating an exemplary security computer system in accordance with an embodiment of the present invention; A block diagram of an exemplary system for managing a plurality of security computer devices in accordance with an embodiment of the present invention; and FIG. 3 is a more detailed illustration of an exemplary architecture for a security computer system in accordance with an embodiment of the present invention. Block diagram.

The present invention will now be described in detail with reference to the accompanying drawings Illustrative examples of the invention are provided to enable those skilled in the art to practice the invention. It is noted that the following drawings and examples are not intended to limit the scope of the invention to a single embodiment, and that other embodiments that interchange some or all of the described or illustrated elements are possible. In addition, when some of the elements of the present invention may be implemented partially or completely using known elements, only those parts of the known elements necessary to understand the invention will be described, and the known elements will be omitted. The detailed description of other parts is provided to avoid obscuring the present invention. It will be apparent to those skilled in the art that, unless otherwise specified herein, embodiments described herein embodied in software are not limited thereto, and may include embodiments implemented in hardware or included in a combination of software and hardware. Embodiments of the implementation and vice versa. In the present specification, the embodiments of the singular elements are not to be considered as limiting; rather, the invention is intended to include other embodiments including the plural elements, and vice versa, unless explicitly stated otherwise. In addition, the Applicant does not intend to use any term in this specification or the scope of the claims for the purpose of the present invention. In addition, the present invention encompasses the present and future known equivalents of the known elements referred to herein.

In accordance with a general aspect, embodiments of the present invention include a security computer platform that forms a robust area of trust, security handling, security I/O, and security management. In an embodiment, the security computer architecture includes a security subsystem that operates independently of the host processor, thereby eliminating the need to modify host CPU hardware or software (eg, operating systems and/or applications). The security subsystem is responsible for the overall security, management, data integrity, activity monitoring, archiving and collaboration of the security computer. According to certain additional aspects, the security function performed by an embodiment of the present invention is upstream Both the host and one or more devices downstream may be logically transparent.

FIG. 1B illustrates an exemplary security computer 120 in accordance with an embodiment of the present invention.

As compared to prior art computer 150 in FIG. 1A and in accordance with certain aspects of the present invention, security computer 120 includes security subsystem 104. In general, the security subsystem 104 operates with the host 102 and is an agnostic portion of the host 102 (ie, the hardware, software, and operating system of the host). For example, the security subsystem 104 neither shares the memory space with the host 120 nor accesses the security subsystem 104 from the operating system and applications of the host CPU. Likewise, host 102 has little or no knowledge of the existence of security subsystem 104. All data visible to host 102 is secure, and all data stored on disk 106-1 or other device connected via port 106-3 (eg, USB mass storage device) or all data transmitted via network 106-4 safe. According to other aspects, the operation of the security subsystem 104 does not reduce the performance of the subsystems associated with the device 106.

Some other aspects of the security computer 120 are in contrast to their prior art computer 150. For example, in a desktop PC implementation, conventional computer 150 typically includes an open interface (not shown), such as a PCI or PCIe expansion bus, by which the PCI or PCIe expansion bus host 102 is coupled to device 106 and Communicating with device 106. However, the inventors believe that there is a potential for security breaches, such as where probes may be inserted to capture/insert data/viruses and the like. Thus, in an embodiment, via secure connection 170, host 102 of security computer 120 communicates with device 106 only via security subsystem 104 and is not connected to any expansion bus, such as PCI or PCIe.

The secure connection 170 can be implemented in a variety of ways depending on the implementation of the host system 102 and the security subsystem 104. In an example where the host system 102 includes a CPU on the standalone wafer (rather than on the shared motherboard) as the security subsystem 104, the secure connection 170 can be implemented by embedding the motherboard traces. In another example, host system 102 and security subsystem 104 are implemented in a shared wafer, such as an SOC. In this example, the secure connection 170 includes an internal wafer trace.

Similarly, in contrast to the conventional computer 150 in accordance with aspects of the present invention, the connection 172 between the security subsystem 104 and the device 106 is also protected. However, it is virtually impossible to always make the external world completely inaccessible to the connection 172. Thus, in an embodiment, such connections 172 are made secure by encrypting the data between subsystem 104 and device 106. It should be noted that certain connections 172 in embodiments of the present invention may include conventional bus bars, such as dedicated PCIe bus bars. However, host 102 does not directly access any of the devices connected to such connections 172 except via subsystem 104, and vice versa.

In accordance with an aspect of the present invention, an embodiment of the security subsystem 104 transparently performs one or more of the following security functions associated with the driver 106-1: data security (e.g., data stored on the driver 106-1) Encryption, key management, antivirus scanning); and data integrity (such as server-based backup using the snapshot mechanism).

With respect to device/device 106-3, embodiments of security subsystem 104 transparently perform one or more of the following security functions: data security (eg, encrypting data sent from host 102, key management); gatekeeper (eg, Prevent being The disabling device is connected to the host 102); data logging; and keyboard and mouse emulation (e.g., keyboard and mouse commands that emulate instructions from the actual keyboard and mouse device 106-3, respectively, by subsystem 104).

With respect to the network interface 106-4, embodiments of the security subsystem 104 transparently perform one or more of the following security functions: VPN (eg, through a secure channel through an Ethernet path connection intended to protect all network traffic) And a three-way switch (for example, to directly transfer network traffic to one of the two hosts 102 or 104).

With respect to the audio/video device 106-2, an embodiment of the security subsystem 104 transparently performs one or more of the following security functions: video overlay from the video stream of the host system 102 and the security subsystem 104; video plus Watermarking; display privacy; screen analysis, such as OCR; remote screen viewing; mixing of audio input from host system 102 and security subsystem 104; audio plus watermarking; and forwarding of audio to a remote management system.

The security computer 120 can be implemented as a desktop PC, notebook, thin client, tablet, smart phone, server, or any other type of computing device (eg, TelePresence Unit, ATM, Industrial controllers, etc.).

It should be noted that in an embodiment such as that illustrated in FIG. 1, security subsystem 104 controls access to all interfaces of computer 120 and peripheral devices 106. However, this is not required, and other embodiments allow host 102 to directly access certain of these devices in a conventional manner. It should be further noted that the particular number and/or combination of devices and interfaces 106 may also depend on the particular implementation of security computer 120.

In one possible implementation, the security subsystem 104 is a separate subsystem and is not configurable. However, in accordance with certain aspects of the present management, in an embodiment, the security subsystem 104 is configurable and one or more security computers are centrally or remotely managed by the remote management system.

Figure 2 illustrates an example of a system for implementing and managing a security computer in accordance with an embodiment of the present invention.

In this example, there are three types of security computers: PC 220-3, notebook 220-2, and point of sale device 220-1, each of which is connected to the remote management system by a separate communication channel 208. 206. Although not separately illustrated, the security subsystem 104 is embedded in each of the appliances 220 and operates transparently to the normal functioning of the device.

In this example, the security PC 220-3 is similar to a conventional stand-alone desktop computer. In this example, the host is implemented by a CPU (eg, x86), a conventional operating system (such as a Windows operating system), and associated device driver software.

Likewise, in this example, the security notebook 220-2 is similar to a conventional stand-alone notebook. In this example, host 102 is implemented by a CPU (e.g., x86), a conventional operating system (such as a Windows operating system), and associated device driver software. However, unlike the PC 220-3, peripheral devices such as a display, a keyboard, and a mouse are integrated inside the computer 220-2 and are not controlled via an external interface such as HDMI and USB.

In the secure point of sale device 220-1, the host 102 can be implemented by an embedded and/or industrial PC.

In this and other examples of security computer 220, subsystem 104 It is preferably an embedded system. Thus, subsystem 104 executes the specified software system provided with the embedded processor, and in any event the terminal user of the computer cannot modify subsystem 104. Various aspects of the type of security function performed by adapting the security subsystem 104 that may be used in the present invention are described in more detail below. After being taught by the examples of existence, those skilled in the art will be able to understand how to implement the security functions of the present invention using software and embedded processors.

FIG. 2 further illustrates remote management system 206 coupled to security computer 220 by respective communication channels 208. Channel 208 can be implemented in a variety of ways, depending on the number and type of devices managed by system 206. Channel 208 can be a separate direct point-to-point link between system 206 and computer 220. In other embodiments, channel 208 can be implemented by a plurality of transmission media shared between computers 220. In these and other embodiments, the media can be any combination of wired or wireless media, such as an Ethernet road or a wireless local area network. In these and other embodiments, channel 208 is implemented by multiple types and/or combinations of public and private networks using proprietary protocols implemented on conventional protocols such as UDP or TCP. In some embodiments, the data transmitted via the three communication channels described above is encrypted, for example, using a secure VPN connection to improve security.

According to a general aspect, in an embodiment of the invention, the remote management system 206 is responsible for managing policies that control the security functions of the security subsystem, including whether to perform data encryption, whether and how to perform data logging, device gatekeeper lists, and the like. Based on such lists and devices attached to computer interface 220, remote management system 206 sends appropriate setup information to the computer via channel 208. 220. System 206 also receives and perhaps further processes data transmitted from device 220 to system 206, such as video data from a monitor of the computer, history of attached devices, keyboard and mouse input data, and disc backup data.

The various aspects of the remote management system and/or the security policies that can be debugged for use in the present invention are described in more detail in the application Serial No. 13/971,711 (UNI-008), the application The contents of the case are hereby incorporated by reference in their entirety.

FIG. 3 is a block diagram of an exemplary security computer 320 in accordance with an embodiment of the present invention.

As shown, the security computer 320 includes a host system 302 and a security subsystem 304. Host system 302 includes the host system 302's own CPU (eg, x86, ARM-based application processor, server CPU, MIPS, QorIQ, or PowerPC), memory, and I/O subsystems. In an embodiment, host system 302 cannot directly access security subsystem 304. In accordance with the aspect of the present invention, an interface between host system 302 and security processor 304 is implemented using standard interfaces (e.g., standard I/O, networking, and storage interfaces) with host system 302 of device 106. In some embodiments, a predetermined communication protocol control interface may be used between the security subsystem 304 and the host system 302 in the case of a dedicated hardware interface (eg, UART) or hardware-only handshake (eg, GPIO).

Security subsystem 304 controls the overall operation of security computer 320, including access by host system 302 to all peripheral devices. Importantly, in accordance with aspects of the present invention, host system 302 cannot be associated with some or all of the computer system peripherals (such as USB and via security subsystem 304). Other I/O devices, network interfaces, storage devices, and audio/video devices exchange data directly. In an embodiment, the security subsystem 304 further controls all power management functions, such as power up sequence, power down sequence, and entering and exiting low power modes. Additionally, the security processor 362 in the security subsystem 304 is first activated and the security processor 362 eventually transitions to sleep or power down. Security subsystem 304 manages all aspects of BIOS authentication and updating. Certain aspects of a computer having a host system 320 and managed by the security subsystem 304 for its overall operation are described in the same application Serial No. 13/396,582, and such aspects can be adapted for use in the present invention.

In an exemplary embodiment in which computer 320 is similar to a conventional desktop PC, computer 320 includes a motherboard, a host CPU, a system bus, and a memory. However, unlike conventional desktop PCs, computer 320 does not include an expansion bus that is accessible to the host CPU, such as PCI or PCIe. In one such embodiment, subsystem 304 is implemented by an ASIC or FPGA separate from the host CPU and transmits data between host system 302 and security system 304 via security, embedded traces on the motherboard. In other embodiments (including embodiments where the computer 320 is a tablet or mobile device (eg, a smart phone), or in other embodiments (where power, area, and/or cost constraints are factors), implemented in the same SOC Both host system 302 and security subsystem 304.

Another possible embodiment includes providing the security subsystem 304 to a PCIe card located in a PCIe expansion bus of a conventional computer. However, unlike conventional computer PCIe expansion busses, this embodiment includes a "security" PCIe connector that will prevent someone from inserting a "probe" between the connector and the card to track the host system 302 and security. Non-addition between sexual subsystems 304 Confidential information. This security connector is preferably safe and destructive. The PCIe card can be inserted into the standard motherboard at the time of manufacture, and the PCIe card cannot be removed thereafter. If someone tries to retrieve the PCIe card afterwards, the connector will be "broken" and the card will not be reinserted (and the card will not operate properly). This effect can be achieved mechanically or even by using a smart sensor that detects an "abnormal" insertion of a PCIe card (ie, a presence device, such as a simple PCIe extender card).

The security processor 362 in the subsystem 304 is typically implemented as an embedded processor, such as an ARM or another embedded processor core. The processor is coupled to memory and other system components, including subsystems 352-360, via a shared bus (such as AXI). In an embodiment, components requiring high speed data transfer are connected via a dedicated point-to-point DMA channel.

Although not illustrated in detail in FIG. 3, embodiments of the security processor 362 include: a CPU (eg, a single-core or multi-core CPU complex); a local DDR memory and a cache memory; and a non-volatile storage device (eg, Flash memory); peripheral devices (such as I2C, SPI, UART, GPIO, etc.); and media engines (such as 2D/3D graphics, audio/video compression). In general, the security processor 362 performs two main tasks: setting up and managing all subsystems, and executing security software stacks, applications, and the like.

As shown in the example of FIG. 3, the computer 320 also includes peripheral devices (keyboard, mouse, camera, microphone, speaker, etc.), peripheral interfaces (USB, etc.), video (ie, display), and network (eg, Ethernet). Network), SATA devices (such as storing HDD/SSD).

As further shown, and as described in more detail below, such peripherals Each of them has a corresponding subsystem 352-360 located in security subsystem 304 that essentially implements a secure I/O environment. These subsystems provide a secure bridge between the host system 302 and the actual device, and implement security tasks such as data encryption/decryption, gatekeeper, and snooping. In accordance with aspects of the present invention, subsystems 352-360 perform such functions that are transparent to host system 302 in real-time with minimal delay and in hardware (fast path).

In addition to managing security tasks performed by subsystems 352-360, security processor 362 performs tasks such as exception handling, analyzing data captured by subsystems 352-360, accumulating traffic statistics, and the like. The security processor 362 also includes a network interface for communicating with the remote management system 206 via the communication channel 308. The communications may include the following: receiving policies from the management system 206 for security functions performed by the subsystems 352-360; transmitting the data captured by the subsystems 352-360 to the management system 206; and detecting the subsystems 352-360 Some of the violations or threats are sent to the management system 206.

In an embodiment, the security processor 362 receives logging/reconnaissance information from a plurality of subsystems and executes an application to store information and analyze the information for potential threat behavior. This may include correlating data from multiple subsystems of a security computer and cross-correlating data between different security computers. If a threat has been detected, an alert is sent to the remote system 206, which will act as a response to modify the policy and apply the policy to the suspected security computer. This may limit or close an interface, or block a user or shut down the entire computer.

In an embodiment, the USB subsystem 352 is responsible for the attached USB The device is associated with one or more tasks, such as data security (eg, encryption, key management), gatekeeper, data logging, and keyboard and mouse emulation. For example, in the same application, applications 13/971, 582 (UNI-007), 13/971, 604 (UNI-009) and 13/971, 632 (UNI-010) describe in more detail Exemplary aspects of these and other security tasks used in the present invention are adapted.

In an embodiment, network subsystem 354 is responsible for associating one or more tasks with Ethernet, WiFi, and 3G devices, such as security security protocols, high-bandwidth connections (eg, IPSec, SSL/TLS), and including tiering and traffic. Control the network processing of the engine.

In an embodiment, storage subsystem 356 is responsible for associating one or more tasks with internal or external storage devices (eg, SATA devices), such as data security (encryption, key management, antivirus scanning), data integrity (eg, Server-based backup using snapshot mechanism) and data compression. These and other security tasks that have been debugged for use in the present invention are described in more detail in the application Serial Nos. 13/971,732 (UNI-012) and 13/971,651 (UNI-013). An exemplary aspect.

In an embodiment, the audio subsystem 358 and the video/graphics subsystem 360 are responsible for associating one or more tasks with an audio/video device, such as a display, a speaker, a microphone, and a camera, one or more of the Tasks such as multi-layer video resizing, alpha blending, audio mixing, audio and video watermarking (visible and invisible), 2D/3D graphics acceleration, compression, secure remote desktop, video conferencing, video surveillance and desktop and video analysis application. More detailed in application 13/971,692 (UNI-015) in the same application Exemplary aspects of such and other security tasks that may be utilized in the present invention are described in detail.

In an embodiment, remote management system 206 controls how security subsystem 304 manages each aspect of computer 320 operations, either dynamically or according to predetermined policies stored to and/or sent to security subsystem 304. In an embodiment, the remote management system 201 remotely controls, monitors, and backs up the I/O interface, and can restrict or completely shut down the I/O interface as needed.

In an embodiment of encrypting/decrypting write storage devices and I/O devices/data read from storage devices and I/O devices, and network traffic, the remote management system 206 manages encryption and authentication keys, and The encryption and authentication keys can be cached locally to the security subsystem 304.

While the invention has been described with respect to the preferred embodiments of the embodiments of the present invention, it is understood that the invention may be modified and modified without departing from the spirit and scope of the invention. The scope of the additional patent application is intended to cover such changes and modifications.

Claims (20)

A security computer includes: a plurality of peripheral subsystems for receiving, storing, and extracting data and outputting data from a storage device; a host system that performs receiving, storing, and capturing And outputting an operating system and an application of the data, the host system comprising a system bus and an interface for connecting the host system to an expansion bus, the expansion bus is separate and independent from the system bus. The expansion bus is one of a peripheral component interconnect (PCI) and a fast PCI (PCIe) expansion bus; a security subsystem that controls access by the host system to the plurality of peripheral subsystems, For receiving, storing, capturing, and outputting the data; and a secure connection between the extended bus interface of the host system and the security subsystem, the security connection connecting the plurality of peripheral subsystems Connect to the host system. The security computer of claim 1, wherein the host system comprises one of an x86 processor, an ARM processor, a MIPS processor, a QorIQ processor, and a PowerPC CPU. The security computer of claim 1, wherein the plurality of peripheral subsystems comprise one or more of the following: a video subsystem, an audio subsystem, a storage subsystem, a network subsystem, and a universal sequence. Bus (USB) subsystem. The security computer of claim 1, wherein the security subsystem is implemented by a field programmable gate array (FPGA) or an application specific integrated circuit (ASIC). The security computer of claim 1, wherein the security subsystem is set by a remote management system external to the security computer. The security computer of claim 5, wherein the remote management system communicates with the security subsystem via a network. The security computer of claim 5, wherein the remote management system specifies how the security subsystem controls access by the host system to the plurality of peripheral subsystems. The security computer of claim 1, wherein the security subsystem comprises an embedded processor. The security computer of claim 8, wherein the embedded processor comprises an ARM processor. The security computer of claim 1, wherein the plurality of peripheral subsystems comprise a sequence of Advanced Technology Attachment (SATA) storage subsystems. The security computer of claim 10, wherein the SATA storage subsystem supports hard drives or solid state drives connected via SATA 1.5, 3.0, and 6.0 Gbs protocols. The security computer of claim 10, wherein the SATA storage subsystem manages the host system and the security subsystem prioritized access to an attached SATA storage device. The security computer of claim 10, wherein the security subsystem performs one or more of: encrypting the data when the SATA storage subsystem stores the data, and the anti-virus scan data of the SATA storage subsystem. The security computer of claim 10, wherein the security subsystem performs automatic backup of data stored by the SATA storage system. The security computer of claim 14, wherein the automatic backup is performed transparently to the host system. A security computer as claimed in claim 3, wherein the USB subsystem supports any device connected via a USB 1.1, 2.0 or 3.0 protocol. The security computer of claim 16, wherein the security subsystem performs one or more of: encrypting data transmitted via the USB subsystem, guarding devices attempting to attach via the USB subsystem, and detecting Via this Information sent or received by the USB subsystem. The security computer of claim 3, wherein the security subsystem performs one or more of: a video overlay from the host system to the video stream of the video subsystem, for display via the video subsystem Video plus watermarking, analysis of the screen displayed via the video subsystem, remote screen viewing of video displayed via the video subsystem, and remote storage and analysis of video displayed via the video subsystem. The security computer of claim 18, wherein the analysis of the displayed screen comprises optical character recognition (OCR). The security computer of claim 3, wherein the security subsystem performs one or more of: mixing audio streams from the host system and the security subsystem for output via the audio subsystem, The audio stream output by the audio subsystem is added to the watermark, and the audio output through the audio subsystem is forwarded to a remote management system.